added CORS to enable cross domain requests